Overview

overview

10

Static

static

9

0x00010000...55.exe

windows7-x64

1

0x00010000...55.exe

windows10-2004-x64

3

0x00010000...47.exe

windows7-x64

3

0x00010000...47.exe

windows10-2004-x64

3

0x00010000...70.exe

windows7-x64

7

0x00010000...70.exe

windows10-2004-x64

7

0x00010000...13.exe

windows7-x64

7

0x00010000...13.exe

windows10-2004-x64

7

0x00020000...73.exe

windows7-x64

9

0x00020000...73.exe

windows10-2004-x64

9

0x00020000...83.exe

windows7-x64

10

0x00020000...83.exe

windows10-2004-x64

10

0x00020000...36.exe

windows7-x64

8

0x00020000...36.exe

windows10-2004-x64

8

0x00020000...40.exe

windows7-x64

10

0x00020000...40.exe

windows10-2004-x64

10

0x00030000...09.exe

windows7-x64

10

0x00030000...09.exe

windows10-2004-x64

10

0x00030000...22.exe

windows7-x64

10

0x00030000...22.exe

windows10-2004-x64

10

0x00030000...26.exe

windows7-x64

10

0x00030000...26.exe

windows10-2004-x64

10

0x00030000...34.exe

windows7-x64

10

0x00030000...34.exe

windows10-2004-x64

10

0x00030000...06.exe

windows7-x64

10

0x00030000...06.exe

windows10-2004-x64

10

0x00030000...41.exe

windows7-x64

3

0x00030000...41.exe

windows10-2004-x64

3

0x00030000...45.exe

windows7-x64

10

0x00030000...45.exe

windows10-2004-x64

10

0x00030000...48.exe

windows7-x64

7

0x00030000...48.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    cf1b38106e42989ddffb99e0163787135e7b294c5d5e88e3b47ca1b7cd0d6681
  • Size 9.0MB
  • Sample241105-j22chsyclr
  • SHA256 cf1b38106e42989ddffb99e0163787135e7b294c5d5e88e3b47ca1b7cd0d6681
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
djvumatanbuchusredlinesmokeloadertofseevidar2010517btc_yearpub1backdoordiscoveryevasionexecutioninfostealerloaderpersistenceprivilege_escalationransomwarespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

  • tofsee

C2

  • 43.231.4.7

  • lazystax.ru

Extracted

Family

  • vidar

Version

  • 34.5

Botnet

  • 517

C2

  • http://newcoldstart.com/

Attributes
  • profile_id

    517

Extracted

Family

  • djvu

C2

  • http://qpao.top/nddddhsspen6/get.php

Attributes
  • extension

    .lisp

  • offline_id

    OERd2J7H77Gx6pSuT1wDtZ44ScPhj765hrrFkKt1

  • payload_url

    http://qpao.top/files/penelop/updatewin1.exe

    http://qpao.top/files/penelop/updatewin2.exe

    http://qpao.top/files/penelop/updatewin.exe

    http://qpao.top/files/penelop/3.exe

    http://qpao.top/files/penelop/4.exe

    http://qpao.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-jydQMZP2Ie Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0267Orjk

rsa_pubkey.plain

Extracted

Family

  • redline

Botnet

  • Btc_YeaR

C2

  • 86.105.252.12:35200

Extracted

Family

  • smokeloader

Botnet

  • pub1

Extracted

Family

  • smokeloader

Botnet

  • 2010

Extracted

Family

  • matanbuchus

C2

  • http://gw397iwauwsf.top/Plugin.triumphdrop

Targets

    • Target
      0x000100000001ab86-55.exe
    • Size 262KB
    • SHA256 205c40f2733ba3e30cc538adc6ac6ee46f4c84a245337a36108095b9280abb37
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      0x000100000001ab87-47.exe
    • Size 71KB
    • SHA256 298d334b630c77b70e66cf5e9c1924c7f0d498b02c2397e92e2d9efdff2e1bdf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      0x000100000001ab9c-70.exe
    • Size 977KB
    • SHA256 bb5d2c07ce902c78227325bf5f336c04335874445fc0635a6b67ae5ba9d2fefc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral5behavioral6
    • Target
      0x000100000001ad02-313.exe
    • Size 620KB
    • SHA256 4788a1207c8a83d6051a12d1bbc63e889fbf142e9479c8d2919e8dcb0e4a6cc4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral7behavioral8
    • Target
      0x000200000001aca8-173.exe
    • Size 61KB
    • SHA256 8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    discoveryupx

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral10behavioral9
    • Target
      0x000200000001acb5-183.exe
    • Size 10.2MB
    • SHA256 23cb1064049da1e64c231cacee9908d9c1aed6a57b786740361d206d14bd2973
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Tofsee family

      tofsee

    • Windows security bypass

      evasiontrojan

    • Creates new service(s)

      persistenceexecution

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral11behavioral12
    • Target
      0x000200000001acdf-236.exe
    • Size 274KB
    • SHA256 5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    discovery

    • Drops file in Drivers directory

    behavioral13behavioral14
    • Target
      0x000200000001ace9-240.exe
    • Size 602KB
    • SHA256 87dc2c320339840a39ae63d4a53a406d2c091573c9f75aa28ea614b454fcfe95
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    vidar517discoveryspywarestealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Vidar Stealer

      stealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral15behavioral16
    • Target
      0x000300000001a5a2-209.exe
    • Size 842KB
    • SHA256 1c5319523b316c789c5c29e87675e580a9016b4624f197df889cb942c9a32bfa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    djvudiscoverypersistenceransomware

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • Djvu family

      djvu

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral17behavioral18
    • Target
      0x000300000001ac90-122.exe
    • Size 411KB
    • SHA256 e6ba7316c20de986784a205b13617c3c13ce4daa628a26d0c2d4bbf0fe7a21c6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    redlinebtc_yeardiscoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline
    behavioral19behavioral20
    • Target
      0x000300000001ac99-126.exe
    • Size 300KB
    • SHA256 0e3774d65577253a820f1ee272d7a0c96e4c6a869ef8f749fe7f83d2fc49f054
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    smokeloaderpub1backdoordiscoverytrojan
    behavioral21behavioral22
    • Target
      0x000300000001ac9e-134.exe
    • Size 311KB
    • SHA256 b0296c0000c40d59a268b223015872d7e57c427358b5e95d1bd6e4ac40dd0f87
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    smokeloader2010backdoordiscoverytrojan
    behavioral23behavioral24
    • Target
      0x000300000001ac9e-206.exe
    • Size 311KB
    • SHA256 b0296c0000c40d59a268b223015872d7e57c427358b5e95d1bd6e4ac40dd0f87
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    smokeloader2010backdoordiscoverytrojan
    behavioral25behavioral26
    • Target
      0x000300000001ac9f-141.exe
    • Size 19KB
    • SHA256 08eb269d6c3bfaf4d3cde53a987e0adc96a171235d3c34e3c6e9422920e793dd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral27behavioral28
    • Target
      0x000300000001acec-245.exe
    • Size 482KB
    • SHA256 23a96527c86ed75232f146343a612a96b8a6e70433cbdf39c9a611aeb3191ddd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    matanbuchusdiscoveryloader
    behavioral29behavioral30
    • Target
      0x000300000001aced-248.exe
    • Size 620KB
    • SHA256 4788a1207c8a83d6051a12d1bbc63e889fbf142e9479c8d2919e8dcb0e4a6cc4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

File and Directory Permissions Modification

1
T1222

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

3
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

upxvmprotect
Score
9/10

behavioral1

Score
1/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
7/10

behavioral6

discovery
Score
7/10

behavioral7

discovery
Score
7/10

behavioral8

discovery
Score
7/10

behavioral9

discoveryupx
Score
9/10

behavioral10

discoveryupx
Score
9/10

behavioral11

tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan
Score
10/10

behavioral12

tofseediscoveryevasionexecutionpersistenceprivilege_escalationtrojan
Score
10/10

behavioral13

discovery
Score
8/10

behavioral14

discovery
Score
8/10

behavioral15

vidar517discoveryspywarestealer
Score
10/10

behavioral16

vidar517discoveryspywarestealer
Score
10/10

behavioral17

djvudiscoverypersistenceransomware
Score
10/10

behavioral18

djvudiscoverypersistenceransomware
Score
10/10

behavioral19

redlinebtc_yeardiscoveryinfostealer
Score
10/10

behavioral20

redlinebtc_yeardiscoveryinfostealer
Score
10/10

behavioral21

smokeloaderpub1backdoordiscoverytrojan
Score
10/10

behavioral22

smokeloaderpub1backdoordiscoverytrojan
Score
10/10

behavioral23

smokeloader2010backdoordiscoverytrojan
Score
10/10

behavioral24

smokeloader2010backdoordiscoverytrojan
Score
10/10

behavioral25

smokeloader2010backdoordiscoverytrojan
Score
10/10

behavioral26

smokeloader2010backdoordiscoverytrojan
Score
10/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

matanbuchusdiscoveryloader
Score
10/10

behavioral30

matanbuchusdiscoveryloader
Score
10/10

behavioral31

discovery
Score
7/10

behavioral32

discovery
Score
7/10